Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
3,919 vulnerabilities · highest exploit probability first
- CVE-2022-42429High 8.8This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon.centreon · centreonEPSS76%·Published Mar 29, 2023
- CVE-2022-42427High 8.8This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon.centreon · centreonEPSS76%·Published Mar 29, 2023
- CVE-2022-42425High 8.8This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon.centreon · centreonEPSS76%·Published Mar 29, 2023
- CVE-2022-42424High 8.8This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon.centreon · centreonEPSS76%·Published Mar 29, 2023
- CVE-2022-36982High 7.5This vulnerability allows remote attackers to read arbitrary files on affected installations of Ivanti Avalanche 6.3.3.101.ivanti · avalancheEPSS74%·Published Mar 29, 2023
- CVE-2022-36981Critical 9.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.3.101.ivanti · avalancheEPSS83%·Published Mar 29, 2023
- CVE-2022-36980High 8.1This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490.ivanti · avalancheEPSS82%·Published Mar 29, 2023
- CVE-2022-36974Critical 9.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490.ivanti · avalancheEPSS84%·Published Mar 29, 2023
- CVE-2022-2560Critical 9.1This vulnerability allows remote attackers to delete arbitrary files on affected installations of EnterpriseDT CompleteFTP 22.1.0 Server.enterprisedt · completeftp serverEPSS78%·Published Mar 29, 2023
- CVE-2022-48428Medium 5.4In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possiblejetbrains · teamcityEPSS68%·Published Mar 27, 2023
- CVE-2023-1133Critical 9.8Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which the Device-status service listens on port 10100/ UDP by default.deltaww · infrasuite device masterEPSS50%1 exploitPublished Mar 27, 2023
- CVE-2023-26801Critical 9.8LB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5, and LB-LINK BL-LTE300 v1.0.8 were discovered to contain a command injection vulnerability via the mac, time1, and time2 parameters at /goform/set_LimitClient_cfg.lb-link · bl-ac1900 firmwareEPSS70%1 exploitPublished Mar 26, 2023
- CVE-2023-1177Critical 9.3mlflow is vulnerable to remote file access in mlflow server and mlflow ui CLIslfprojects · mlflowEPSS70%·Published Mar 24, 2023
- CVE-2023-27034Critical 9.8PrestaShop jmsblog 2.5.5 was discovered to contain a SQL injection vulnerability.joommasters · jms blogEPSS59%·Published Mar 23, 2023
- CVE-2023-26361Medium 4.9Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in Arbitrary file system read.adobe · coldfusionEPSS59%·Published Mar 23, 2023
- CVE-2023-1578High 8.8Pimcore Remote Code Execution vulnerability in Search functionpimcore · pimcoreEPSS63%·Published Mar 22, 2023
- CVE-2023-27856High 7.5In affected versions, path traversal exists when processing a message of type 8rockwellautomation · thinmanagerEPSS77%·Published Mar 21, 2023
- CVE-2023-0631High 8.8Paid Memberships Pro <= 2.9.11 - Authenticated (Subscriber+) SQL Injection via Shortcodesstrangerstudios · paid memberships proEPSS60%·Published Mar 21, 2023
- CVE-2023-28425Medium 5.5Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process.redis · redisEPSS59%·Published Mar 20, 2023
- CVE-2022-43781Critical 9.8There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center.atlassian · bitbucketEPSS98%1 exploitPublished Mar 20, 2023
- CVE-2023-27253High 8.8A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via manipulating the contents of an XML file supplied to the component config.xml.netgate · pfsenseEPSS90%2 exploitsPublished Mar 17, 2023
- CVE-2023-28343Critical 9.8OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in the index.php/management/set_timezone timezone parameter, because of set_timezone in models/management_model.php.apsystems · energy communication unit firmwareEPSS85%2 exploitsPublished Mar 14, 2023
- CVE-2022-37436Medium 5.3Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body.apache · http serverEPSS56%·Published Mar 13, 2023
- CVE-2022-44574High 7.5An improper authentication vulnerability exists in Avalanche version 6.3.x and below allows unauthenticated attacker to modify properties on specific port.ivanti · avalancheEPSS62%·Published Mar 10, 2023
- CVE-2023-25573High 7.5In affected versions an improper access control vulnerability exists in /api/jmeter/download/files, which allows any user to download any file without authentication.metersphere · metersphereEPSS52%1 exploitPublished Mar 9, 2023
- CVE-2023-0050Medium 5.4A specially crafted Kroki diagram could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims.gitlab · gitlabEPSS92%·Published Mar 9, 2023
- CVE-2023-27482Critical 10.0A remotely exploitable vulnerability bypassing authentication for accessing the Supervisor API through Home Assistant has been discovered.home-assistant · home-assistantEPSS72%·Published Mar 8, 2023
- CVE-2021-36393Critical 9.8Moodle SQL Injection vulnerabilitymoodle · moodleEPSS52%·Published Mar 6, 2023
- CVE-2023-26477Critical 9.8org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerabilityxwiki · xwikiEPSS75%1 exploitPublished Mar 3, 2023
- CVE-2023-26475High 8.8xwiki-platform vulnerable to Remote Code Execution in Annotationsxwiki · xwikiEPSS64%1 exploitPublished Mar 2, 2023
- CVE-2022-36021Medium 5.5Authenticated users can use string matching commands (like SCAN or KEYS) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time.redis · redisEPSS60%·Published Mar 1, 2023
- CVE-2022-47075High 7.5An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to download sensitive information via the action name parameter to ExportEmployeeDetails.aspx, and to ExportReportingManager.aspx.smartofficepayroll · smartofficeEPSS59%1 exploitPublished Feb 28, 2023
- CVE-2023-27372Critical 9.8SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled.spip · spipEPSS100%2 exploitsPublished Feb 28, 2023
- CVE-2022-2024Critical 9.8Gogs OS Command Injection vulnerabilitygogs · gogsEPSS98%·Published Feb 28, 2023
- CVE-2023-27293Medium 6.1Improper neutralization of input during web page generation allows an unauthenticated attacker to submit malicious Javascript as the answer to a questionnaire which would then be executed when an authenticated user reviews the candidate's submission.opencats · opencatsEPSS57%·Published Feb 28, 2023
- CVE-2023-26035Critical 9.8Versions prior to 1.36.33 and 1.37.33 are vulnerable to Unauthenticated Remote Code Execution via Missing Authorization.zoneminder · zoneminderEPSS80%1 exploitPublished Feb 25, 2023
- CVE-2022-48343Medium 6.1In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process.jetbrains · teamcityEPSS59%·Published Feb 23, 2023
- CVE-2023-21707High 8.8Microsoft Exchange Server Remote Code Execution Vulnerabilitymicrosoft · exchange serverEPSS82%·Published Feb 23, 2023
- CVE-2023-25157Critical 9.8GeoServer OGC Filter SQL Injection Vulnerabilitiesosgeo · geoserverEPSS85%·Published Feb 22, 2023
- CVE-2022-29273Medium 6.1pfSense CE through 2.6.0 and pfSense Plus before 22.05 allow XSS in the WebGUI via URL Table Alias URL parameters.netgate · pfsenseEPSS60%·Published Feb 22, 2023
- CVE-2022-23521Critical 9.8Git is distributed revision control system.git-scm · gitEPSS56%·Published Feb 21, 2023
- CVE-2023-22232Medium 5.3Adobe Connect versions 11.4.5 (and earlier), 12.1.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass.adobe · connectEPSS83%2 exploitsPublished Feb 17, 2023
- CVE-2022-39952Critical 9.8A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an unauthenticated attacker to execute unauthorized code or…fortinet · fortinacEPSS100%1 exploitPublished Feb 17, 2023
- CVE-2023-24078High 8.8Real Time Logic FuguHub v8.1 and earlier was discovered to contain a remote code execution (RCE) vulnerability via the component /FuguHub/cmsdocs/.realtimelogic · fuguhubEPSS53%2 exploitsPublished Feb 17, 2023
- CVE-2023-23836High 7.2SolarWinds Platform version 2022.4.1 was found to be susceptible to the Deserialization of Untrusted Data.solarwinds · orion platformEPSS80%·Published Feb 15, 2023
- CVE-2022-38111High 7.2SolarWinds Platform was susceptible to the Deserialization of Untrusted Data.solarwinds · orion platformEPSS85%·Published Feb 15, 2023
- CVE-2023-24580High 8.7Resource exhaustion in Djangodjangoproject · djangoEPSS63%·Published Feb 15, 2023
- CVE-2023-21716Critical 9.8Microsoft Word Remote Code Execution Vulnerabilitymicrosoft · wordEPSS85%Ransomware1 actorPublished Feb 14, 2023
- CVE-2023-0159High 7.5Extensive VC Addons for WPBakery page builder <= 1.9 - Unauthenticated Local File Inclusionwprealize · extensive vc addons for wpbakery page builderEPSS55%1 exploitPublished Feb 14, 2023
- CVE-2022-4830Medium 6.1The Paid Memberships Pro WordPress plugin before 2.9.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be…strangerstudios · paid memberships proEPSS65%·Published Feb 13, 2023
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-42429 | This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. centreon · centreon | High 8.8 | 76% | · | |
| CVE-2022-42427 | This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. centreon · centreon | High 8.8 | 76% | · | |
| CVE-2022-42425 | This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. centreon · centreon | High 8.8 | 76% | · | |
| CVE-2022-42424 | This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. centreon · centreon | High 8.8 | 76% | · | |
| CVE-2022-36982 | This vulnerability allows remote attackers to read arbitrary files on affected installations of Ivanti Avalanche 6.3.3.101. ivanti · avalanche | High 7.5 | 74% | · | |
| CVE-2022-36981 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.3.101. ivanti · avalanche | Critical 9.8 | 83% | · | |
| CVE-2022-36980 | This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. ivanti · avalanche | High 8.1 | 82% | · | |
| CVE-2022-36974 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. ivanti · avalanche | Critical 9.8 | 84% | · | |
| CVE-2022-2560 | This vulnerability allows remote attackers to delete arbitrary files on affected installations of EnterpriseDT CompleteFTP 22.1.0 Server. enterprisedt · completeftp server | Critical 9.1 | 78% | · | |
| CVE-2022-48428 | In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possible jetbrains · teamcity | Medium 5.4 | 68% | · | |
| CVE-2023-1133 | Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which the Device-status service listens on port 10100/ UDP by default. deltaww · infrasuite device master | Critical 9.8 | 50% | 1 exploit | |
| CVE-2023-26801 | LB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5, and LB-LINK BL-LTE300 v1.0.8 were discovered to contain a command injection vulnerability via the mac, time1, and time2 parameters at /goform/set_LimitClient_cfg. lb-link · bl-ac1900 firmware | Critical 9.8 | 70% | 1 exploit | |
| CVE-2023-1177 | mlflow is vulnerable to remote file access in mlflow server and mlflow ui CLIs lfprojects · mlflow | Critical 9.3 | 70% | · | |
| CVE-2023-27034 | PrestaShop jmsblog 2.5.5 was discovered to contain a SQL injection vulnerability. joommasters · jms blog | Critical 9.8 | 59% | · | |
| CVE-2023-26361 | Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in Arbitrary file system read. adobe · coldfusion | Medium 4.9 | 59% | · | |
| CVE-2023-1578 | Pimcore Remote Code Execution vulnerability in Search function pimcore · pimcore | High 8.8 | 63% | · | |
| CVE-2023-27856 | In affected versions, path traversal exists when processing a message of type 8 rockwellautomation · thinmanager | High 7.5 | 77% | · | |
| CVE-2023-0631 | Paid Memberships Pro <= 2.9.11 - Authenticated (Subscriber+) SQL Injection via Shortcodes strangerstudios · paid memberships pro | High 8.8 | 60% | · | |
| CVE-2023-28425 | Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. redis · redis | Medium 5.5 | 59% | · | |
| CVE-2022-43781 | There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. atlassian · bitbucket | Critical 9.8 | 98% | 1 exploit | |
| CVE-2023-27253 | A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via manipulating the contents of an XML file supplied to the component config.xml. netgate · pfsense | High 8.8 | 90% | 2 exploits | |
| CVE-2023-28343 | OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in the index.php/management/set_timezone timezone parameter, because of set_timezone in models/management_model.php. apsystems · energy communication unit firmware | Critical 9.8 | 85% | 2 exploits | |
| CVE-2022-37436 | Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. apache · http server | Medium 5.3 | 56% | · | |
| CVE-2022-44574 | An improper authentication vulnerability exists in Avalanche version 6.3.x and below allows unauthenticated attacker to modify properties on specific port. ivanti · avalanche | High 7.5 | 62% | · | |
| CVE-2023-25573 | In affected versions an improper access control vulnerability exists in /api/jmeter/download/files, which allows any user to download any file without authentication. metersphere · metersphere | High 7.5 | 52% | 1 exploit | |
| CVE-2023-0050 | A specially crafted Kroki diagram could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims. gitlab · gitlab | Medium 5.4 | 92% | · | |
| CVE-2023-27482 | A remotely exploitable vulnerability bypassing authentication for accessing the Supervisor API through Home Assistant has been discovered. home-assistant · home-assistant | Critical 10.0 | 72% | · | |
| CVE-2021-36393 | Moodle SQL Injection vulnerability moodle · moodle | Critical 9.8 | 52% | · | |
| CVE-2023-26477 | org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability xwiki · xwiki | Critical 9.8 | 75% | 1 exploit | |
| CVE-2023-26475 | xwiki-platform vulnerable to Remote Code Execution in Annotations xwiki · xwiki | High 8.8 | 64% | 1 exploit | |
| CVE-2022-36021 | Authenticated users can use string matching commands (like SCAN or KEYS) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. redis · redis | Medium 5.5 | 60% | · | |
| CVE-2022-47075 | An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to download sensitive information via the action name parameter to ExportEmployeeDetails.aspx, and to ExportReportingManager.aspx. smartofficepayroll · smartoffice | High 7.5 | 59% | 1 exploit | |
| CVE-2023-27372 | SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. spip · spip | Critical 9.8 | 100% | 2 exploits | |
| CVE-2022-2024 | Gogs OS Command Injection vulnerability gogs · gogs | Critical 9.8 | 98% | · | |
| CVE-2023-27293 | Improper neutralization of input during web page generation allows an unauthenticated attacker to submit malicious Javascript as the answer to a questionnaire which would then be executed when an authenticated user reviews the candidate's submission. opencats · opencats | Medium 6.1 | 57% | · | |
| CVE-2023-26035 | Versions prior to 1.36.33 and 1.37.33 are vulnerable to Unauthenticated Remote Code Execution via Missing Authorization. zoneminder · zoneminder | Critical 9.8 | 80% | 1 exploit | |
| CVE-2022-48343 | In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process. jetbrains · teamcity | Medium 6.1 | 59% | · | |
| CVE-2023-21707 | Microsoft Exchange Server Remote Code Execution Vulnerability microsoft · exchange server | High 8.8 | 82% | · | |
| CVE-2023-25157 | GeoServer OGC Filter SQL Injection Vulnerabilities osgeo · geoserver | Critical 9.8 | 85% | · | |
| CVE-2022-29273 | pfSense CE through 2.6.0 and pfSense Plus before 22.05 allow XSS in the WebGUI via URL Table Alias URL parameters. netgate · pfsense | Medium 6.1 | 60% | · | |
| CVE-2022-23521 | Git is distributed revision control system. git-scm · git | Critical 9.8 | 56% | · | |
| CVE-2023-22232 | Adobe Connect versions 11.4.5 (and earlier), 12.1.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. adobe · connect | Medium 5.3 | 83% | 2 exploits | |
| CVE-2022-39952 | A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an unauthenticated attacker to execute unauthorized code or… fortinet · fortinac | Critical 9.8 | 100% | 1 exploit | |
| CVE-2023-24078 | Real Time Logic FuguHub v8.1 and earlier was discovered to contain a remote code execution (RCE) vulnerability via the component /FuguHub/cmsdocs/. realtimelogic · fuguhub | High 8.8 | 53% | 2 exploits | |
| CVE-2023-23836 | SolarWinds Platform version 2022.4.1 was found to be susceptible to the Deserialization of Untrusted Data. solarwinds · orion platform | High 7.2 | 80% | · | |
| CVE-2022-38111 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. solarwinds · orion platform | High 7.2 | 85% | · | |
| CVE-2023-24580 | Resource exhaustion in Django djangoproject · django | High 8.7 | 63% | · | |
| CVE-2023-21716 | Microsoft Word Remote Code Execution Vulnerability microsoft · word | Critical 9.8 | 85% | Ransomware1 actor | |
| CVE-2023-0159 | Extensive VC Addons for WPBakery page builder <= 1.9 - Unauthenticated Local File Inclusion wprealize · extensive vc addons for wpbakery page builder | High 7.5 | 55% | 1 exploit | |
| CVE-2022-4830 | The Paid Memberships Pro WordPress plugin before 2.9.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be… strangerstudios · paid memberships pro | Medium 6.1 | 65% | · |
Showing 651–700 of 3,919
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.